Call us now:
Material, Reasonable, adequate are the core tenets of the SEC final cyber rule (https://lnkd.in/e8u6mj4a). It’s a challenges that boards face and must reach a conclusion on, not just for incident reporting. But to demonstrate they are managing material cyber risks ‘Left of Bang’.
Plenty of focus is placed on cyber incident reporting, as it relates to the SEC final cyber rule. But little is discussed about the real elephant in the room, that is material cyber risk management.
When one considers the significant U.S and EU cyber risk management regulations, they have a common theme. A theme that is the demonstration of cybersecurity risk management by covered boards. Covered boards are required to demonstrate they have oversight, assurance and can attest to their organisations cybersecurity risk management. That is a major challenge, requiring covered firms to demonstrate governance, risk management, risk mitigation and the provenance of data used in regulatory reporting.
Rachel V. Rose, JD, MBA and @Thaddeus Dziekanowski as we wrote and have presented many times, the focus of regulators is to require boards to demonstrate they understand material risk and have implemented reasonable and adequate risk mitigation to protect the reasonable investor. As we see with the SEC vs. SolarWinds case, organisations that cannot demonstrate material risk management and regulatory reporting, prior to incidents, may come unstuck as regulators evaluate compliance.
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7200040807364468736